WordPress security by component
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Plugin description
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 10, 2026; the highest CVE/CNA score is 9.1.
Plugin slug:
wp-cafeLatest vulnerability
CVE-2026-11818: WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: A security weakness
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.0.14.
| Safe version |
|
||
|---|---|---|---|
| Jul 10, 2026 |
CVE-2026-11818
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: A security weakness
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.0.14.
|
> 3.0.14 |
CVE5.4
NVDPending
|
| Jun 26, 2026 |
CVE-2026-57622
WPCafe: A security weakness
WPCafe is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.0.14.
|
3.0.15 |
CVE4.3
NVDPending
|
| Mar 25, 2026 |
CVE-2026-27071
WPCafe: A security weakness
WPCafe is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.0.7.
|
3.0.8 |
CVE9.1
NVDPending
|
| Apr 17, 2025 |
CVE-2025-39452
WPCafe: Filesystem traversal
WPCafe is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Mar 27, 2025 |
CVE-2025-30829
WPCafe: Filesystem traversal
WPCafe is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Aug 13, 2024 |
CVE-2024-43135
WPCafe: Filesystem traversal
WPCafe is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVD8.8
|
| Jul 09, 2024 |
CVE-2024-37513
WPCafe: Filesystem traversal
WPCafe is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.5
NVD8.8
|
| Jun 25, 2024 |
CVE-2024-5431
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce: Filesystem traversal
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce is affected by filesystem traversal. Exploitation requires at least contributor-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 31, 2024 |
CVE-2024-5427
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce: Cross-site scripting
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 23, 2024 |
CVE-2024-1855
WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation: Server-side request forgery
WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.
|
See mitigation notes |
CVE5.3
NVDPending
|